feat(oidc-client): implement authorize API #344

cerebrl · 2025-07-09T00:44:02Z

Suggestions for using stronger design patterns for authorize. Treat this as non-working pseudocode.

introduce the oidc-client with the authorize api. authoirize handles the calling of authorize routes based on the well-known config. when a p1 env is detected, it will use a post request otherwise, a background request is done via a hidden iframe

changeset-bot · 2025-07-09T00:44:05Z

⚠️ No Changeset found

Latest commit: f35d74a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

nx-cloud · 2025-07-09T00:44:53Z

View your CI Pipeline Execution ↗ for commit f35d74a

Command	Status	Duration	Result
`nx affected -t build typecheck lint test e2e-ci`	❌ Failed	1m 39s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	1s	View ↗

☁️ Nx Cloud last updated this comment at 2025-07-16 06:43:45 UTC

ryanbas21 · 2025-07-16T13:02:28Z

packages/oidc-client/src/lib/authorize.request.ts

+) {
+  const buildAuthorizeRequestµ = buildAuthorizeOptionsµ(wellknown, config, options).pipe(
+    Micro.flatMap(([url, config, options]) => createAuthorizeUrlµ(url, config, options)),
+    (effect) => {


Any specific reason we are using this arrow function style here?

ryanbas21

some initial looks over will look again

ryanbas21 · 2025-07-16T13:04:47Z

packages/oidc-client/src/lib/authorize.request.ts

+  const buildAuthorizeRequestµ = buildAuthorizeOptionsµ(wellknown, config, options).pipe(
+    Micro.flatMap(([url, config, options]) => createAuthorizeUrlµ(url, config, options)),
+    (effect) => {
+      return Micro.matchEffect(effect, {


i'd be curious if just using tapError and tap would be better fits here

https://effect-ts.github.io/effect/effect/Micro.ts.html#taperror

https://effect-ts.github.io/effect/effect/Micro.ts.html#tap

tapError would only run on error channels, and tap on success channels

ryanbas21 · 2025-07-16T13:12:45Z

packages/oidc-client/src/lib/authorize.request.ts

+            return Micro.gen(function* () {
+              if ('authorizeResponse' in response) {
+                log.debug('Received authorize response', response.authorizeResponse);
+                return yield* Micro.succeed(response.authorizeResponse as AuthorizeSuccessResponse);


I think the succeed here is redundant in a gen it should implicitly return a Micro here

ryanbas21 · 2025-07-16T13:13:57Z

packages/oidc-client/src/lib/authorize.request.ts

+              }
+              log.error('Error in authorize response', response);
+              const errorResponse = response as { error: string; error_description: string };
+              return yield* createAuthorizeErrorµ(errorResponse, wellknown, config, options);


Would we want to Fail out of this effect here? This keeps the error in the success channel, is that what we want?

Micro/Effect should always keep Errors are values, so i think it would make sense to Fail out of it.

ryanbas21 · 2025-07-16T13:14:48Z

packages/oidc-client/src/lib/authorize.request.ts

+         * redirect based server supporting iframes. An example would be PingAM.
+         */
+        return authorizeIframeµ(url, config).pipe(
+          Micro.flatMap((response) => {


I think given the below changes this could just be a map now?

ryanbas21 · 2025-07-16T13:22:36Z

packages/oidc-client/src/lib/authorize.request.utils.ts

+
+export function authorizeFetchµ(url: string) {
+  return Micro.tryPromise({
+    try: async () => {


Nothing inherently wrong with this, just going to say how I usually write this.

Because tryPromise takes a Promise, I find it easier to just pass in fetch with no awaiting. then break down the steps following it in their own sequences. This allows for more granular error handling in my opinion.

Micro.tryPromise({ try: (signal) => fetch('....', { signal }), catch: (e) => new MyFetchError() }).pipe( Micro.flatMap(res => Micro.tryPromise({ try: () => res.json(), catch: (err) => new ResJsonErr() })));

(not sure we can use Data if we use Micro, but it's just a helper around making errors, not required in the below example)
https://effect.website/play#5b10175aea48

ryanbas21 · 2025-07-16T13:23:03Z

packages/oidc-client/src/lib/authorize.request.utils.ts

+      }
+
+      return {
+        error: 'Authorization Notwork Failure',


Notwork spelling?

ryanbas21 · 2025-07-16T13:23:37Z

packages/oidc-client/src/lib/authorize.request.utils.ts

+
+export function authorizeIframeµ(url: string, config: OidcConfig) {
+  return Micro.tryPromise({
+    try: async () => {


np; unneccessary body?

ryanbas21 · 2025-07-16T13:28:09Z

packages/oidc-client/src/lib/client.store.ts

+          return err;
+        }
+
+        const result = await authorizeµ(wellknown, config, log, options);


I'm curious if it may be more clear to runPromiseExit here where we explicitly want to run the effect.

this keeps the actual authorize effect self-contained and composable later on?

ryanbas21 · 2025-07-16T14:53:29Z

packages/oidc-client/src/lib/authorize.request.ts

+export async function authorizeµ(
+  wellknown: WellKnownResponse,
+  config: OidcConfig,
+  log: CustomLogger,


this would be a good use case for a service (like we discussed) so we don't need to pass around the logger throughout the api

ryanbas21 · 2025-07-16T18:49:31Z

packages/oidc-client/src/lib/authorize.request.ts

+         */
+        return authorizeFetchµ(url).pipe(
+          Micro.flatMap((response) => {
+            return Micro.gen(function* () {


I actually think this entire gen is unneccessary since you're just returning effects you can do that out of flatMap and no need for gen

ryanbas21 · 2025-07-16T18:55:44Z

packages/oidc-client/src/lib/authorize.request.ts

+import type { OidcConfig } from './config.types.js';
+import { AuthorizeSuccessResponse } from './authorize.request.types.js';
+
+export async function authorizeµ(


export async function authorizeµ( wellknown: WellKnownResponse, config: OidcConfig, log: CustomLogger, options?: GetAuthorizationUrlOptions, ) { return buildAuthorizeOptionsµ(wellknown, config, options).pipe( Micro.flatMap(([url, config, options]) => createAuthorizeUrlµ(url, config, options)), Micro.tap((url) => log.debug('Created authorization URL', { url })), /** * This probably needs to change because `log` doesn't reutrn an effect / micro and we want to return one from here * really `log` needs to be wrapped in a service i guess */ Micro.tapError((url) => Micro.fail(log.error('Created authorization URL', { url }))), Micro.flatMap(([url, config, options]) => { if (options.responseMode === 'pi.flow') { /** * If we support the pi.flow field, this means we are using a PingOne server. * PingOne servers do not support redirection through iframes because they * set iframe's to DENY. */ return authorizeFetchµ(url).pipe( Micro.flatMap((response) => { if ('authorizeResponse' in response) { log.debug('Received authorize response', response.authorizeResponse); return Micro.succeed(response.authorizeResponse as AuthorizeSuccessResponse); } log.error('Error in authorize response', response); const errorResponse = response as { error: string; error_description: string }; return Micro.fail(createAuthorizeErrorµ(errorResponse, wellknown, config, options)); }), ); } else { /** * If the response mode is not pi.flow, then we are likely using a traditional * redirect based server supporting iframes. An example would be PingAM. */ return authorizeIframeµ(url, config).pipe( Micro.flatMap((response) => { if ('code' in response && 'state' in response) { log.debug('Received authorization code', response); return Micro.succeed(response as unknown as AuthorizeSuccessResponse); } log.error('Error in authorize response', response); const errorResponse = response as { error: string; error_description: string }; return Micro.fail(createAuthorizeErrorµ(errorResponse, wellknown, config, options)); }), ); } }), /** * This could be moved out of this authorize function */ Micro.runPromiseExit, ); }

did a rewrite, feel free to pick and choose but really the key parts are undid a few unneccessary layers of Micro and then explicitly Fail when we should return an error.

one smaller re-write

export function authorizeµ( wellknown: WellKnownResponse, config: OidcConfig, log: CustomLogger, options?: GetAuthorizationUrlOptions, ) { return buildAuthorizeOptionsµ(wellknown, config, options).pipe( Micro.flatMap(([url, config, options]) => createAuthorizeUrlµ(url, config, options)), Micro.tap((url) => log.debug('Created authorization URL', { url })), Micro.tapError((url) => Micro.sync(() => log.error('Created authorization URL', { url }))), Micro.flatMap(([url, config, options]) => { if (options.responseMode === 'pi.flow') { return authorizeFetchµ(url).pipe( Micro.map((response) => { if ('authorizeResponse' in response) { return response.authorizeResponse as AuthorizeSuccessResponse; } const errorResponse = response as { error: string; error_description: string }; return Micro.fail(createAuthorizeErrorµ(errorResponse, wellknown, config, options)); }), Micro.tap((response) => log.debug('Received authorize response', response)), Micro.tapError((response) => Micro.sync(() => log.error('Error in authorize response', response)), ), ); } else { return authorizeIframeµ(url, config).pipe( Micro.map((response) => { if ('code' in response && 'state' in response) { return response as unknown as AuthorizeSuccessResponse; } const errorResponse = response as { error: string; error_description: string }; return Micro.fail(createAuthorizeErrorµ(errorResponse, wellknown, config, options)); }), Micro.tap((response) => log.debug('Received authorize response', response)), Micro.tapError((response) => Micro.sync(() => log.error('Error in authorize response', response)), ), ); } }), ); }

ryanbas21 · 2025-07-16T22:09:18Z

packages/oidc-client/src/lib/authorize.request.ts

+    }),
+  );
+
+  return Micro.runPromiseExit(buildAuthorizeRequestµ);


Thinking about this more, wouldn't this be against our pattern of running effects at the edge? i'd think we'd want this to be as close to the edge of the program as possible.

I'd advocate this happen at the top level if possible

Yeah, I agree with all of your comments. This one especially. I was actually going to move this to the top file, but didn't get around to it.

ancheetah · 2025-07-18T13:41:08Z

packages/oidc-client/README.md

+const authResponse = oidcClient.authorize.background(); // Returns code and state if successful, error and Auth URL if not
+const authUrl = oidcClient.authorize.url(); // Returns Auth URL or error
+
+// Tokens API


Do the tokens api and user api exist on the OIDC client yet? Didn't see them on the client store

Yeah, this is just the authorize feature. Token exchange is found here: #348. The other token related methods are not implemeneted yet.

ancheetah · 2025-07-18T14:29:29Z

packages/sdk-effects/iframe-manager/src/lib/iframe-manager.effects.ts

@@ -116,7 +116,7 @@ export default function iFrameManager() {
              // 1. Check for Error Parameters
              if (hasErrorParams(searchParams, errorParams)) {
                cleanup();
-                reject(parsedParams); // Reject with all parsed params for context
+                resolve(parsedParams); // Reject with all parsed params for context


Why not reject and catch it with a Micro.fail in authorizeIframeµ?

I think this is reasonable now that the code is more mature. I'll reevaluate this today.

ancheetah · 2025-07-18T14:30:06Z

packages/oidc-client/src/lib/authorize.request.ts

@@ -0,0 +1,81 @@
+import { CustomLogger } from '@forgerock/sdk-logger';


Missing copyright in some files

feat: implement-authorize-oidc-client

0d07220

introduce the oidc-client with the authorize api. authoirize handles the calling of authorize routes based on the well-known config. when a p1 env is detected, it will use a post request otherwise, a background request is done via a hidden iframe

cerebrl force-pushed the justin_oidc-mods branch 2 times, most recently from 0a12961 to abc572c Compare July 10, 2025 21:39

cerebrl added 2 commits July 11, 2025 15:43

feat(oidc-client): implement stronger patterns

abd8a85

feat(oidc-client): introduce Effect in authorize

0b1e1dd

cerebrl force-pushed the justin_oidc-mods branch from abc572c to 0b1e1dd Compare July 14, 2025 18:37

feat(oidc-client): improve Effect usage

f35d74a

cerebrl changed the base branch from oidc-client-authorize to main July 16, 2025 06:42

cerebrl changed the title ~~feat(oidc-client): implement stronger patterns~~ feat(oidc-client): implement authorize API Jul 16, 2025

ryanbas21 reviewed Jul 16, 2025

View reviewed changes

ancheetah reviewed Jul 18, 2025

View reviewed changes

		@@ -0,0 +1,81 @@
		import { CustomLogger } from '@forgerock/sdk-logger';

feat(oidc-client): implement authorize API #344

Are you sure you want to change the base?

feat(oidc-client): implement authorize API #344

Uh oh!

Conversation

cerebrl commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

nx-cloud bot commented Jul 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryanbas21 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryanbas21 Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryanbas21 Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cerebrl commented Jul 9, 2025 •

edited

Loading

changeset-bot bot commented Jul 9, 2025 •

edited

Loading

nx-cloud bot commented Jul 9, 2025 •

edited

Loading

ryanbas21 Jul 16, 2025 •

edited

Loading

ryanbas21 Jul 16, 2025 •

edited

Loading